#include "events.h"

const struct nod_event_info g_event_info[NODE_EVENT_MAX] = {
	[NODE_GENERIC] = {"syscall", EC_OTHER, EF_NONE, 1, {{"ID", PT_SYSCALLID, PF_DEC} } },
	[NODE_SYSCALL_OPEN] = {"open", EC_FILE, EF_CREATES_FD | EF_MODIFIES_STATE, 5, {{"fd", PT_FD, PF_DEC}, {"name", PT_FSPATH, PF_NA}, {"flags", PT_FLAGS32, PF_HEX, file_flags}, {"mode", PT_UINT32, PF_OCT}, {"dev", PT_UINT32, PF_HEX} } },
	[NODE_SYSCALL_CLOSE] = {"close", EC_IO_OTHER, EF_DESTROYS_FD | EF_USES_FD | EF_MODIFIES_STATE | EF_DROP_SIMPLE_CONS, 2, {{"fd", PT_FD, PF_DEC}, {"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_READ] = {"read", EC_IO_READ, EF_USES_FD | EF_READS_FROM_FD | EF_DROP_SIMPLE_CONS, 4, {{"fd", PT_FD, PF_DEC}, {"size", PT_UINT32, PF_DEC}, {"res", PT_ERRNO, PF_DEC}, {"data", PT_BYTEBUF, PF_NA} } },
	[NODE_SYSCALL_WRITE] = {"write", EC_IO_WRITE, EF_USES_FD | EF_WRITES_TO_FD | EF_DROP_SIMPLE_CONS, 4, {{"fd", PT_FD, PF_DEC}, {"size", PT_UINT32, PF_DEC}, {"res", PT_ERRNO, PF_DEC}, {"data", PT_BYTEBUF, PF_NA} } },
    [NODE_SYSCALL_BRK_1] = {"brk", EC_MEMORY, EF_OLD_VERSION, 2, {{"size", PT_UINT32, PF_DEC} ,{"res", PT_UINT64, PF_HEX}} },
	[NODE_SYSCALL_EXIT] = {"exit", EC_PROCESS, EF_MODIFIES_STATE, 1, {{"code", PT_INT32, PF_DEC}}},
	[NODE_SYSCALL_EXIT_GROUP] = {"exit_group", EC_PROCESS, EF_MODIFIES_STATE, 1, {{"code", PT_INT32, PF_DEC}}},
	[NODE_SYSCALL_EXECVE_8] = {"execve", EC_PROCESS, EF_MODIFIES_STATE, 19, {{"filename", PT_FSPATH, PF_NA}, {"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_INT32, PF_DEC}, {"pgid", PT_PID, PF_DEC}, {"loginuid", PT_INT32, PF_DEC} } },
	[NODE_SYSCALL_CLONE_11] = {"clone", EC_PROCESS, EF_MODIFIES_STATE, 19, {{"res", PT_PID, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_INT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"flags", PT_FLAGS32, PF_HEX, clone_flags}, {"uid", PT_UINT32, PF_DEC}, {"gid", PT_UINT32, PF_DEC}, {"vtid", PT_PID, PF_DEC}, {"vpid", PT_PID, PF_DEC} } },
	[NODE_SOCKET_SOCKET] = {"socket", EC_NET, EF_CREATES_FD | EF_MODIFIES_STATE, 4, {{"domain", PT_FLAGS32, PF_DEC, socket_families}, {"type", PT_UINT32, PF_DEC}, {"proto", PT_UINT32, PF_DEC} , {"fd", PT_FD, PF_DEC}} },
	[NODE_SOCKET_BIND] = {"bind", EC_NET, EF_USES_FD | EF_MODIFIES_STATE, 3, {{"fd", PT_FD, PF_DEC}, {"res", PT_ERRNO, PF_DEC}, {"addr", PT_SOCKADDR, PF_NA} } },
	[NODE_SOCKET_CONNECT] = {"connect", EC_NET, EF_USES_FD | EF_MODIFIES_STATE, 3, {{"fd", PT_FD, PF_DEC}, {"res", PT_ERRNO, PF_DEC}, {"tuple", PT_SOCKTUPLE, PF_NA} } },
	[NODE_SOCKET_LISTEN] = {"listen", EC_NET, EF_USES_FD, 3, {{"fd", PT_FD, PF_DEC}, {"backlog", PT_UINT32, PF_DEC}, {"res", PT_ERRNO, PF_DEC} } },
	[NODE_SOCKET_ACCEPT] = {"accept", EC_NET, EF_CREATES_FD | EF_MODIFIES_STATE, 3, {{"fd", PT_FD, PF_DEC}, {"tuple", PT_SOCKTUPLE, PF_NA}, {"queuepct", PT_UINT8, PF_DEC} } },
	[NODE_SOCKET_SEND] = {"send", EC_IO_WRITE, EF_USES_FD | EF_WRITES_TO_FD | EF_DROP_SIMPLE_CONS, 4, {{"fd", PT_FD, PF_DEC}, {"size", PT_UINT32, PF_DEC},{"res", PT_ERRNO, PF_DEC}, {"data", PT_BYTEBUF, PF_NA} } },
	[NODE_SOCKET_SENDTO] = {"sendto", EC_IO_WRITE, EF_USES_FD | EF_WRITES_TO_FD | EF_MODIFIES_STATE, 5, {{"fd", PT_FD, PF_DEC}, {"size", PT_UINT32, PF_DEC}, {"tuple", PT_SOCKTUPLE, PF_NA}, {"res", PT_ERRNO, PF_DEC}, {"data", PT_BYTEBUF, PF_NA} } },
	[NODE_SOCKET_RECV] = {"recv", EC_IO_READ, EF_USES_FD | EF_READS_FROM_FD | EF_DROP_SIMPLE_CONS, 4, {{"fd", PT_FD, PF_DEC}, {"size", PT_UINT32, PF_DEC},{"res", PT_ERRNO, PF_DEC}, {"data", PT_BYTEBUF, PF_NA} } },
	[NODE_SOCKET_RECVFROM] = {"recvfrom", EC_IO_READ, EF_USES_FD | EF_READS_FROM_FD | EF_MODIFIES_STATE, 5, {{"fd", PT_FD, PF_DEC}, {"size", PT_UINT32, PF_DEC}, {"res", PT_ERRNO, PF_DEC}, {"data", PT_BYTEBUF, PF_NA}, {"tuple", PT_SOCKTUPLE, PF_NA} } },
	[NODE_SOCKET_SHUTDOWN] = {"shutdown", EC_NET, EF_USES_FD | EF_MODIFIES_STATE | EF_DROP_SIMPLE_CONS, 3, {{"fd", PT_FD, PF_DEC}, {"how", PT_FLAGS8, PF_HEX, shutdown_how}, {"res", PT_ERRNO, PF_DEC} } },
	[NODE_SOCKET_GETSOCKNAME] = {"getsockname", EC_NET, EF_DROP_SIMPLE_CONS, 0},
	[NODE_SOCKET_GETPEERNAME] = {"getpeername", EC_NET, EF_DROP_SIMPLE_CONS, 0},
	[NODE_SOCKET_SOCKETPAIR] = {"socketpair", EC_IPC, EF_CREATES_FD | EF_MODIFIES_STATE, 8, {{"domain", PT_FLAGS32, PF_DEC, socket_families}, {"type", PT_UINT32, PF_DEC}, {"proto", PT_UINT32, PF_DEC}, {"res", PT_ERRNO, PF_DEC}, {"fd1", PT_FD, PF_DEC}, {"fd2", PT_FD, PF_DEC}, {"source", PT_UINT64, PF_HEX}, {"peer", PT_UINT64, PF_HEX} } },
	[NODE_SOCKET_SETSOCKOPT] = {"setsockopt", EC_NET, EF_USES_FD, 6, {{"res", PT_ERRNO, PF_DEC}, {"fd", PT_FD, PF_DEC}, {"level", PT_FLAGS8, PF_DEC, sockopt_levels}, {"optname", PT_FLAGS8, PF_DEC, sockopt_options}, {"val", PT_DYN, PF_DEC, sockopt_dynamic_param, NOD_SOCKOPT_IDX_MAX}, {"optlen", PT_UINT32, PF_DEC}}},
	[NODE_SOCKET_GETSOCKOPT] = {"getsockopt", EC_NET, EF_USES_FD | EF_MODIFIES_STATE| EF_DROP_SIMPLE_CONS, 6, {{"res", PT_ERRNO, PF_DEC}, {"fd", PT_FD, PF_DEC}, {"level", PT_FLAGS8, PF_DEC, sockopt_levels}, {"optname", PT_FLAGS8, PF_DEC, sockopt_options}, {"val", PT_DYN, PF_DEC, sockopt_dynamic_param, NOD_SOCKOPT_IDX_MAX}, {"optlen", PT_UINT32, PF_DEC}}},
	[NODE_SOCKET_SENDMSG] = {"sendmsg", EC_IO_WRITE, EF_USES_FD | EF_WRITES_TO_FD | EF_MODIFIES_STATE, 5, {{"fd", PT_FD, PF_DEC}, {"size", PT_UINT32, PF_DEC}, {"tuple", PT_SOCKTUPLE, PF_NA}, {"res", PT_ERRNO, PF_DEC}, {"data", PT_BYTEBUF, PF_NA} } },
	[NODE_SOCKET_SENDMMSG] = {"sendmmsg", EC_IO_WRITE, EF_DROP_SIMPLE_CONS, 0},
	[NODE_SOCKET_RECVMSG] = {"recvmsg", EC_IO_READ, EF_USES_FD | EF_READS_FROM_FD | EF_MODIFIES_STATE, 5, {{"fd", PT_FD, PF_DEC}, {"res", PT_ERRNO, PF_DEC}, {"size", PT_UINT32, PF_DEC}, {"data", PT_BYTEBUF, PF_NA}, {"tuple", PT_SOCKTUPLE, PF_NA} } },
	[NODE_SOCKET_RECVMMSG] = {"recvmmsg", EC_IO_READ, EF_DROP_SIMPLE_CONS, 0},
	[NODE_SYSCALL_CREAT] = {"creat", EC_FILE, EF_CREATES_FD | EF_MODIFIES_STATE, 4, {{"fd", PT_FD, PF_DEC}, {"name", PT_FSPATH, PF_NA}, {"mode", PT_UINT32, PF_OCT}, {"dev", PT_UINT32, PF_HEX} } },
	[NODE_SYSCALL_PIPE] = {"pipe", EC_IPC, EF_CREATES_FD | EF_MODIFIES_STATE, 4, {{"res", PT_ERRNO, PF_DEC}, {"fd1", PT_FD, PF_DEC}, {"fd2", PT_FD, PF_DEC}, {"ino", PT_UINT64, PF_DEC} } },
	[NODE_SYSCALL_EVENTFD] = {"eventfd", EC_IPC, EF_CREATES_FD | EF_MODIFIES_STATE | EF_DROP_SIMPLE_CONS, 3, {{"initval", PT_UINT64, PF_DEC}, {"flags", PT_FLAGS32, PF_HEX},{"res", PT_FD, PF_DEC}  } },
	[NODE_SYSCALL_FUTEX] = {"futex", EC_IPC, EF_DROP_SIMPLE_CONS, 4, {{"addr", PT_UINT64, PF_HEX}, {"op", PT_FLAGS16, PF_HEX, futex_operations}, {"val", PT_UINT64, PF_DEC} , {"res", PT_ERRNO, PF_DEC}} },
	[NODE_SYSCALL_STAT] = {"stat", EC_FILE, EF_DROP_SIMPLE_CONS, 2, {{"res", PT_ERRNO, PF_DEC}, {"path", PT_FSPATH, PF_NA} } },
	[NODE_SYSCALL_LSTAT] = {"lstat", EC_FILE, EF_DROP_SIMPLE_CONS, 2, {{"res", PT_ERRNO, PF_DEC}, {"path", PT_FSPATH, PF_NA} } },
	[NODE_SYSCALL_FSTAT] = {"fstat", EC_FILE, EF_USES_FD | EF_DROP_SIMPLE_CONS, 2, {{"fd", PT_FD, PF_NA},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_STAT64] = {"stat64", EC_FILE, EF_DROP_SIMPLE_CONS, 2, {{"res", PT_ERRNO, PF_DEC}, {"path", PT_FSPATH, PF_NA} } },
	[NODE_SYSCALL_LSTAT64] = {"lstat64", EC_FILE, EF_DROP_SIMPLE_CONS, 2, {{"res", PT_ERRNO, PF_DEC}, {"path", PT_FSPATH, PF_NA} } },
	[NODE_SYSCALL_FSTAT64] = {"fstat64", EC_FILE, EF_USES_FD | EF_DROP_SIMPLE_CONS, 2, {{"fd", PT_FD, PF_NA},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_EPOLLWAIT] = {"epoll_wait", EC_WAIT, EF_WAITS | EF_DROP_SIMPLE_CONS, 2, {{"maxevents", PT_ERRNO, PF_DEC},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_POLL] = {"poll", EC_WAIT, EF_WAITS | EF_DROP_SIMPLE_CONS, 4, {{"fds", PT_FDLIST, PF_DEC}, {"timeout", PT_INT64, PF_DEC}, {"res", PT_ERRNO, PF_DEC}, {"fds", PT_FDLIST, PF_DEC} } },
	[NODE_SYSCALL_SELECT] = {"select", EC_WAIT, EF_WAITS | EF_DROP_SIMPLE_CONS, 1, {{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_LSEEK] = {"lseek", EC_FILE, EF_USES_FD | EF_DROP_SIMPLE_CONS, 4, {{"fd", PT_FD, PF_DEC}, {"offset", PT_UINT64, PF_DEC}, {"whence", PT_FLAGS8, PF_DEC, lseek_whence} , {"res", PT_ERRNO, PF_DEC}} },
	[NODE_SYSCALL_LLSEEK] = {"llseek", EC_FILE, EF_USES_FD | EF_DROP_SIMPLE_CONS, 4, {{"fd", PT_FD, PF_DEC}, {"offset", PT_UINT64, PF_DEC}, {"whence", PT_FLAGS8, PF_DEC, lseek_whence} , {"res", PT_ERRNO, PF_DEC}} },
	[NODE_SYSCALL_GETCWD] = {"getcwd", EC_FILE, EF_DROP_SIMPLE_CONS, 2, {{"res", PT_ERRNO, PF_DEC}, {"path", PT_CHARBUF, PF_NA} } },
	[NODE_SYSCALL_CHDIR] = {"chdir", EC_FILE, EF_MODIFIES_STATE, 2, {{"res", PT_ERRNO, PF_DEC}, {"path", PT_CHARBUF, PF_NA} } },
	[NODE_SYSCALL_FCHDIR] = {"fchdir", EC_FILE, EF_USES_FD | EF_MODIFIES_STATE, 2, {{"fd", PT_FD, PF_NA},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_MKDIR] = {"mkdir", EC_FILE, EF_NONE, 3, {{"path", PT_FSPATH, PF_NA}, {"mode", PT_UINT32, PF_HEX},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_RMDIR] = {"rmdir", EC_FILE, EF_NONE, 2, {{"path", PT_FSPATH, PF_NA},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_OPENAT] = {"openat", EC_FILE, EF_CREATES_FD | EF_MODIFIES_STATE | EF_OLD_VERSION, 5, {{"dirfd", PT_FD, PF_DEC}, {"name", PT_CHARBUF, PF_NA}, {"flags", PT_FLAGS32, PF_HEX, file_flags}, {"mode", PT_UINT32, PF_OCT},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_LINK] = {"link", EC_FILE, EF_OLD_VERSION, 3, {{"oldpath", PT_FSPATH, PF_NA}, {"newpath", PT_FSPATH, PF_NA},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_LINKAT] = {"linkat", EC_FILE, EF_OLD_VERSION, 5, {{"olddir", PT_FD, PF_DEC}, {"oldpath", PT_CHARBUF, PF_NA}, {"newdir", PT_FD, PF_DEC}, {"newpath", PT_CHARBUF, PF_NA},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_UNLINK] = {"unlink", EC_FILE, EF_OLD_VERSION, 2, {{"path", PT_FSPATH, PF_NA},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_UNLINKAT] = {"unlinkat", EC_FILE, EF_OLD_VERSION, 3, {{"dirfd", PT_FD, PF_DEC}, {"name", PT_CHARBUF, PF_NA},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_PREAD] = {"pread", EC_IO_READ, EF_USES_FD | EF_READS_FROM_FD | EF_DROP_SIMPLE_CONS, 5, {{"fd", PT_FD, PF_DEC}, {"size", PT_UINT32, PF_DEC}, {"pos", PT_UINT64, PF_DEC},{"res", PT_ERRNO, PF_DEC}, {"data", PT_BYTEBUF, PF_NA} } },
	[NODE_SYSCALL_PWRITE] = {"pwrite", EC_IO_WRITE, EF_USES_FD | EF_WRITES_TO_FD | EF_DROP_SIMPLE_CONS, 5, {{"fd", PT_FD, PF_DEC}, {"size", PT_UINT32, PF_DEC}, {"pos", PT_UINT64, PF_DEC},{"res", PT_ERRNO, PF_DEC}, {"data", PT_BYTEBUF, PF_NA} } },
	[NODE_SYSCALL_READV] = {"readv", EC_IO_READ, EF_USES_FD | EF_READS_FROM_FD | EF_DROP_SIMPLE_CONS, 4, {{"fd", PT_FD, PF_DEC},{"res", PT_ERRNO, PF_DEC}, {"size", PT_UINT32, PF_DEC}, {"data", PT_BYTEBUF, PF_NA} } },
	[NODE_SYSCALL_WRITEV] = {"writev", EC_IO_WRITE, EF_USES_FD | EF_WRITES_TO_FD | EF_DROP_SIMPLE_CONS, 4, {{"fd", PT_FD, PF_DEC}, {"size", PT_UINT32, PF_DEC},{"res", PT_ERRNO, PF_DEC}, {"data", PT_BYTEBUF, PF_NA} } },
	[NODE_SYSCALL_PREADV] = {"preadv", EC_IO_READ, EF_USES_FD | EF_READS_FROM_FD | EF_DROP_SIMPLE_CONS, 5, {{"fd", PT_FD, PF_DEC}, {"pos", PT_UINT64, PF_DEC},{"res", PT_ERRNO, PF_DEC}, {"size", PT_UINT32, PF_DEC}, {"data", PT_BYTEBUF, PF_NA} } },
	[NODE_SYSCALL_PWRITEV] = {"pwritev", EC_IO_WRITE, EF_USES_FD | EF_WRITES_TO_FD | EF_DROP_SIMPLE_CONS, 5, {{"fd", PT_FD, PF_DEC}, {"size", PT_UINT32, PF_DEC}, {"pos", PT_UINT64, PF_DEC},{"res", PT_ERRNO, PF_DEC}, {"data", PT_BYTEBUF, PF_NA} } },
	[NODE_SYSCALL_DUP] = {"dup", EC_IO_OTHER, EF_CREATES_FD | EF_USES_FD | EF_MODIFIES_STATE, 2, {{"fd", PT_FD, PF_DEC} ,{"res", PT_FD, PF_DEC}} },
	[NODE_SYSCALL_SIGNALFD] = {"signalfd", EC_SIGNAL, EF_CREATES_FD | EF_MODIFIES_STATE, 4, {{"fd", PT_FD, PF_DEC}, {"mask", PT_UINT32, PF_HEX}, {"flags", PT_FLAGS8, PF_HEX},{"res", PT_FD, PF_DEC} } },
	[NODE_SYSCALL_KILL] = {"kill", EC_SIGNAL, EF_NONE, 3, {{"pid", PT_PID, PF_DEC}, {"sig", PT_SIGTYPE, PF_DEC},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_TKILL] = {"tkill", EC_SIGNAL, EF_NONE, 3, {{"tid", PT_PID, PF_DEC}, {"sig", PT_SIGTYPE, PF_DEC} ,{"res", PT_ERRNO, PF_DEC}} },
	[NODE_SYSCALL_TGKILL] = {"tgkill", EC_SIGNAL, EF_NONE, 4, {{"pid", PT_PID, PF_DEC}, {"tid", PT_PID, PF_DEC}, {"sig", PT_SIGTYPE, PF_DEC},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_NANOSLEEP] = {"nanosleep", EC_SLEEP, EF_WAITS | EF_DROP_SIMPLE_CONS, 2, {{"interval", PT_RELTIME, PF_DEC} ,{"res", PT_ERRNO, PF_DEC}} },
	[NODE_SYSCALL_TIMERFD_CREATE] = {"timerfd_create", EC_TIME, EF_CREATES_FD | EF_MODIFIES_STATE | EF_DROP_SIMPLE_CONS, 3, {{"clockid", PT_UINT8, PF_DEC}, {"flags", PT_FLAGS8, PF_HEX}, {"res", PT_FD, PF_DEC} } },
	[NODE_SYSCALL_INOTIFY_INIT] = {"inotify_init", EC_IPC, EF_CREATES_FD | EF_MODIFIES_STATE, 2, {{"flags", PT_FLAGS8, PF_HEX},{"res", PT_FD, PF_DEC} } },
	[NODE_SYSCALL_GETRLIMIT] = {"getrlimit", EC_PROCESS, EF_DROP_SIMPLE_CONS, 4, {{"resource", PT_FLAGS8, PF_DEC, rlimit_resources},{"res", PT_ERRNO, PF_DEC}, {"cur", PT_INT64, PF_DEC}, {"max", PT_INT64, PF_DEC} } },
	[NODE_SYSCALL_SETRLIMIT] = {"setrlimit", EC_PROCESS, EF_DROP_SIMPLE_CONS, 4, {{"resource", PT_FLAGS8, PF_DEC, rlimit_resources},{"res", PT_ERRNO, PF_DEC}, {"cur", PT_INT64, PF_DEC}, {"max", PT_INT64, PF_DEC} } },
	[NODE_SYSCALL_PRLIMIT] = {"prlimit", EC_PROCESS, EF_NONE, 7, {{"pid", PT_PID, PF_DEC}, {"resource", PT_FLAGS8, PF_DEC, rlimit_resources},{"res", PT_ERRNO, PF_DEC}, {"newcur", PT_INT64, PF_DEC}, {"newmax", PT_INT64, PF_DEC}, {"oldcur", PT_INT64, PF_DEC}, {"oldmax", PT_INT64, PF_DEC} } },
	[NODE_SYSCALL_FCNTL] = {"fcntl", EC_IO_OTHER, EF_USES_FD | EF_MODIFIES_STATE | EF_DROP_SIMPLE_CONS, 3, {{"fd", PT_FD, PF_DEC}, {"cmd", PT_FLAGS8, PF_DEC, fcntl_commands},{"res", PT_FD, PF_DEC} } },
	[NODE_SYSCALL_BRK_4] = {"brk", EC_MEMORY, EF_DROP_SIMPLE_CONS, 5, {{"addr", PT_UINT64, PF_HEX},{"res", PT_UINT64, PF_HEX}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC} } },
	[NODE_SYSCALL_MMAP] = {"mmap", EC_MEMORY, EF_DROP_SIMPLE_CONS, 10, {{"addr", PT_UINT64, PF_HEX}, {"length", PT_UINT64, PF_DEC}, {"prot", PT_FLAGS32, PF_HEX, prot_flags}, {"flags", PT_FLAGS32, PF_HEX, mmap_flags}, {"fd", PT_FD, PF_DEC}, {"offset", PT_UINT64, PF_DEC},{"res", PT_UINT64, PF_HEX}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC} } },
	[NODE_SYSCALL_MMAP2] = {"mmap2", EC_MEMORY, EF_DROP_SIMPLE_CONS, 10, {{"addr", PT_UINT64, PF_HEX}, {"length", PT_UINT64, PF_DEC}, {"prot", PT_FLAGS32, PF_HEX, prot_flags}, {"flags", PT_FLAGS32, PF_HEX, mmap_flags}, {"fd", PT_FD, PF_DEC}, {"pgoffset", PT_UINT64, PF_DEC},{"res", PT_UINT64, PF_HEX}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC},{"res", PT_UINT64, PF_HEX}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC} } },
	[NODE_SYSCALL_MUNMAP] = {"munmap", EC_MEMORY, EF_DROP_SIMPLE_CONS, 6, {{"addr", PT_UINT64, PF_HEX}, {"length", PT_UINT64, PF_DEC},{"res", PT_ERRNO, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC} } },
	[NODE_SYSCALL_SPLICE] = {"splice", EC_IO_OTHER, EF_USES_FD | EF_DROP_SIMPLE_CONS, 4, {{"fd_in", PT_FD, PF_DEC}, {"fd_out", PT_FD, PF_DEC}, {"size", PT_UINT64, PF_DEC}, {"flags", PT_FLAGS32, PF_HEX, splice_flags},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_PTRACE] = {"ptrace", EC_PROCESS, EF_NONE, 5, {{"request", PT_FLAGS16, PF_DEC, ptrace_requests}, {"pid", PT_PID, PF_DEC}, {"res", PT_ERRNO, PF_DEC}, {"addr", PT_DYN, PF_HEX, ptrace_dynamic_param, NOD_PTRACE_IDX_MAX}, {"data", PT_DYN, PF_HEX, ptrace_dynamic_param, NOD_PTRACE_IDX_MAX} } },
	[NODE_SYSCALL_IOCTL_3] = {"ioctl", EC_IO_OTHER, EF_USES_FD, 4, {{"fd", PT_FD, PF_DEC}, {"request", PT_UINT64, PF_HEX}, {"argument", PT_UINT64, PF_HEX},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_EXECVE_14] = {"execve", EC_PROCESS, EF_MODIFIES_STATE | EF_OLD_VERSION, 14, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"env", PT_BYTEBUF, PF_NA} } },
	[NODE_SYSCALL_RENAME] = {"rename", EC_FILE, EF_NONE, 3, {{"res", PT_ERRNO, PF_DEC}, {"oldpath", PT_FSPATH, PF_NA}, {"newpath", PT_FSPATH, PF_NA} } },
	[NODE_SYSCALL_RENAMEAT] = {"renameat", EC_FILE, EF_NONE, 5, {{"res", PT_ERRNO, PF_DEC}, {"olddirfd", PT_FD, PF_DEC}, {"oldpath", PT_FSRELPATH, PF_NA, DIRFD_PARAM(1)}, {"newdirfd", PT_FD, PF_DEC}, {"newpath", PT_FSRELPATH, PF_NA, DIRFD_PARAM(3)} } },
	[NODE_SYSCALL_SYMLINK] = {"symlink", EC_FILE, EF_NONE, 3, {{"res", PT_ERRNO, PF_DEC}, {"target", PT_CHARBUF, PF_NA}, {"linkpath", PT_FSPATH, PF_NA} } },
	[NODE_SYSCALL_SYMLINKAT] = {"symlinkat", EC_FILE, EF_NONE, 4, {{"res", PT_ERRNO, PF_DEC}, {"target", PT_CHARBUF, PF_NA}, {"linkdirfd", PT_FD, PF_DEC}, {"linkpath", PT_FSRELPATH, PF_NA, DIRFD_PARAM(2)} } },
	[NODE_SYSCALL_FORK] = {"fork", EC_PROCESS, EF_MODIFIES_STATE, 19, {{"res", PT_PID, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_INT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"flags", PT_FLAGS32, PF_HEX, clone_flags}, {"uid", PT_UINT32, PF_DEC}, {"gid", PT_UINT32, PF_DEC}, {"vtid", PT_PID, PF_DEC}, {"vpid", PT_PID, PF_DEC} } },
	[NODE_SYSCALL_VFORK] = {"vfork", EC_PROCESS, EF_MODIFIES_STATE, 19, {{"res", PT_PID, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_INT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"flags", PT_FLAGS32, PF_HEX, clone_flags}, {"uid", PT_UINT32, PF_DEC}, {"gid", PT_UINT32, PF_DEC}, {"vtid", PT_PID, PF_DEC}, {"vpid", PT_PID, PF_DEC} } },
	[NODE_SYSCALL_SENDFILE] = {"sendfile", EC_IO_WRITE, EF_USES_FD | EF_DROP_SIMPLE_CONS, 6, {{"out_fd", PT_FD, PF_DEC}, {"in_fd", PT_FD, PF_DEC}, {"offset", PT_UINT64, PF_DEC}, {"size", PT_UINT64, PF_DEC},{"res", PT_ERRNO, PF_DEC}, {"offset", PT_UINT64, PF_DEC} } },
	[NODE_SYSCALL_QUOTACTL] = {"quotactl", EC_USER, EF_NONE, 18, {{"cmd", PT_FLAGS16, PF_DEC, quotactl_cmds }, {"type", PT_FLAGS8, PF_DEC, quotactl_types}, {"id", PT_UINT32, PF_DEC}, {"quota_fmt", PT_FLAGS8, PF_DEC, quotactl_quota_fmts },{"res", PT_ERRNO, PF_DEC}, {"special", PT_CHARBUF, PF_NA }, {"quotafilepath", PT_CHARBUF, PF_NA}, {"dqb_bhardlimit", PT_UINT64, PF_DEC }, {"dqb_bsoftlimit", PT_UINT64, PF_DEC }, {"dqb_curspace", PT_UINT64, PF_DEC }, {"dqb_ihardlimit", PT_UINT64, PF_DEC }, {"dqb_isoftlimit", PT_UINT64, PF_DEC }, {"dqb_btime", PT_RELTIME, PF_DEC }, {"dqb_itime", PT_RELTIME, PF_DEC }, {"dqi_bgrace", PT_RELTIME, PF_DEC }, {"dqi_igrace", PT_RELTIME, PF_DEC }, {"dqi_flags", PT_FLAGS8, PF_DEC, quotactl_dqi_flags }, {"quota_fmt_out", PT_FLAGS8, PF_DEC, quotactl_quota_fmts } } },
	[NODE_SYSCALL_SETRESUID] = {"setresuid", EC_USER, EF_MODIFIES_STATE, 4, {{"ruid", PT_UID, PF_DEC }, {"euid", PT_UID, PF_DEC }, {"suid", PT_UID, PF_DEC },{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_SETRESGID] = {"setresgid", EC_USER, EF_MODIFIES_STATE, 4, {{"rgid", PT_GID, PF_DEC }, {"egid", PT_GID, PF_DEC }, {"sgid", PT_GID, PF_DEC },{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_SETUID] = {"setuid", EC_USER, EF_MODIFIES_STATE, 2, {{"uid", PT_UID, PF_DEC},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_SETGID] = {"setgid", EC_USER, EF_MODIFIES_STATE, 2, {{"gid", PT_GID, PF_DEC},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_GETUID] = {"getuid", EC_USER, EF_DROP_SIMPLE_CONS, 1, {{"uid", PT_UID, PF_DEC} } },
	[NODE_SYSCALL_GETEUID] = {"geteuid", EC_USER, EF_DROP_SIMPLE_CONS, 1, {{"euid", PT_UID, PF_DEC}}},
	[NODE_SYSCALL_GETGID] = {"getgid", EC_USER, EF_DROP_SIMPLE_CONS, 1, {{"gid", PT_GID, PF_DEC} } },
	[NODE_SYSCALL_GETEGID] = {"getegid", EC_USER, EF_DROP_SIMPLE_CONS, 1, {{"egid", PT_GID, PF_DEC}}},
	[NODE_SYSCALL_GETRESUID] = {"getresuid", EC_USER, EF_DROP_SIMPLE_CONS, 4, {{"res", PT_ERRNO, PF_DEC}, {"ruid", PT_UID, PF_DEC }, {"euid", PT_UID, PF_DEC }, {"suid", PT_UID, PF_DEC } } },
	[NODE_SYSCALL_GETRESGID] = {"getresgid", EC_USER, EF_DROP_SIMPLE_CONS, 4, {{"res", PT_ERRNO, PF_DEC}, {"rgid", PT_GID, PF_DEC }, {"egid", PT_GID, PF_DEC }, {"sgid", PT_GID, PF_DEC } } },
	[NODE_SYSCALL_EXECVE_15] = {"execve", EC_PROCESS, EF_MODIFIES_STATE | EF_OLD_VERSION, 15, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA} } },
	[NODE_SYSCALL_CLONE_17] = {"clone", EC_PROCESS, EF_MODIFIES_STATE | EF_OLD_VERSION, 17, {{"res", PT_PID, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_INT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"flags", PT_FLAGS32, PF_HEX, clone_flags}, {"uid", PT_UINT32, PF_DEC}, {"gid", PT_UINT32, PF_DEC} } },
	[NODE_SYSCALL_FORK_17] = {"fork", EC_PROCESS, EF_MODIFIES_STATE | EF_OLD_VERSION, 17, {{"res", PT_PID, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_INT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"flags", PT_FLAGS32, PF_HEX, clone_flags}, {"uid", PT_UINT32, PF_DEC}, {"gid", PT_UINT32, PF_DEC} } },
	[NODE_SYSCALL_VFORK_17] = {"vfork", EC_PROCESS, EF_MODIFIES_STATE | EF_OLD_VERSION, 17, {{"res", PT_PID, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_INT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"flags", PT_FLAGS32, PF_HEX, clone_flags}, {"uid", PT_UINT32, PF_DEC}, {"gid", PT_UINT32, PF_DEC} } },
	[NODE_SYSCALL_CLONE_20] = {"clone", EC_PROCESS, EF_MODIFIES_STATE, 20, {{"res", PT_PID, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_INT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"flags", PT_FLAGS32, PF_HEX, clone_flags}, {"uid", PT_UINT32, PF_DEC}, {"gid", PT_UINT32, PF_DEC}, {"vtid", PT_PID, PF_DEC}, {"vpid", PT_PID, PF_DEC} } },
	[NODE_SYSCALL_FORK_20] = {"fork", EC_PROCESS, EF_MODIFIES_STATE, 20, {{"res", PT_PID, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_INT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"flags", PT_FLAGS32, PF_HEX, clone_flags}, {"uid", PT_UINT32, PF_DEC}, {"gid", PT_UINT32, PF_DEC}, {"vtid", PT_PID, PF_DEC}, {"vpid", PT_PID, PF_DEC} } },
	[NODE_SYSCALL_VFORK_20] = {"vfork", EC_PROCESS, EF_MODIFIES_STATE, 20, {{"res", PT_PID, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_INT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"flags", PT_FLAGS32, PF_HEX, clone_flags}, {"uid", PT_UINT32, PF_DEC}, {"gid", PT_UINT32, PF_DEC}, {"vtid", PT_PID, PF_DEC}, {"vpid", PT_PID, PF_DEC} } },
	[NODE_SYSCALL_EXECVE_16] = {"execve", EC_PROCESS, EF_MODIFIES_STATE, 16, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA} } },
	[NODE_SYSCALL_GETDENTS] = {"getdents", EC_FILE, EF_USES_FD | EF_DROP_SIMPLE_CONS, 2, {{"fd", PT_FD, PF_NA},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_GETDENTS64] = {"getdents64", EC_FILE, EF_USES_FD | EF_DROP_SIMPLE_CONS, 2, {{"fd", PT_FD, PF_NA} ,{"res", PT_ERRNO, PF_DEC}} },
	[NODE_SYSCALL_SETNS] = {"setns", EC_PROCESS, EF_USES_FD, 3, {{"fd", PT_FD, PF_NA}, {"nstype", PT_FLAGS32, PF_HEX, clone_flags},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_FLOCK] = {"flock", EC_FILE, EF_USES_FD, 3, {{"fd", PT_FD, PF_NA}, {"operation", PT_FLAGS32, PF_HEX, flock_flags},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SOCKET_ACCEPT_5] = {"accept", EC_NET, EF_CREATES_FD | EF_MODIFIES_STATE, 5, {{"fd", PT_FD, PF_DEC}, {"tuple", PT_SOCKTUPLE, PF_NA}, {"queuepct", PT_UINT8, PF_DEC}, {"queuelen", PT_UINT32, PF_DEC}, {"queuemax", PT_UINT32, PF_DEC} } },
	[NODE_SOCKET_ACCEPT4_5] = {"accept", EC_NET, EF_CREATES_FD | EF_MODIFIES_STATE, 6, {{"flags", PT_INT32, PF_HEX},{"fd", PT_FD, PF_DEC}, {"tuple", PT_SOCKTUPLE, PF_NA}, {"queuepct", PT_UINT8, PF_DEC}, {"queuelen", PT_UINT32, PF_DEC}, {"queuemax", PT_UINT32, PF_DEC} } },
	[NODE_SYSCALL_SEMOP] = {"semop", EC_PROCESS, EF_DROP_SIMPLE_CONS, 9, {{"semid", PT_INT32, PF_DEC},{"res", PT_ERRNO, PF_DEC}, {"nsops", PT_UINT32, PF_DEC}, {"sem_num_0", PT_UINT16, PF_DEC}, {"sem_op_0", PT_INT16, PF_DEC}, {"sem_flg_0", PT_FLAGS16, PF_HEX, semop_flags}, {"sem_num_1", PT_UINT16, PF_DEC}, {"sem_op_1", PT_INT16, PF_DEC}, {"sem_flg_1", PT_FLAGS16, PF_HEX, semop_flags} } },
	[NODE_SYSCALL_SEMCTL] = {"semctl", EC_PROCESS, EF_DROP_SIMPLE_CONS, 5, {{"semid", PT_INT32, PF_DEC}, {"semnum", PT_INT32, PF_DEC}, {"cmd", PT_FLAGS16, PF_HEX, semctl_commands}, {"val", PT_INT32, PF_DEC} ,{"res", PT_ERRNO, PF_DEC}} },
	[NODE_SYSCALL_PPOLL] = {"ppoll", EC_WAIT, EF_WAITS | EF_DROP_SIMPLE_CONS, 5, {{"fds", PT_FDLIST, PF_DEC}, {"timeout", PT_RELTIME, PF_DEC}, {"sigmask", PT_SIGSET, PF_DEC} ,{"res", PT_ERRNO, PF_DEC}, {"fds", PT_FDLIST, PF_DEC}} },
	[NODE_SYSCALL_MOUNT] = {"mount", EC_FILE, EF_MODIFIES_STATE, 5, {{"flags", PT_FLAGS32, PF_HEX, mount_flags},{"res", PT_ERRNO, PF_DEC}, {"dev", PT_CHARBUF, PF_NA}, {"dir", PT_FSPATH, PF_NA}, {"type", PT_CHARBUF, PF_NA} } },
	[NODE_SYSCALL_UMOUNT] = {"umount", EC_FILE, EF_MODIFIES_STATE, 3, {{"flags", PT_FLAGS32, PF_HEX, umount_flags} ,{"res", PT_ERRNO, PF_DEC}, {"name", PT_FSPATH, PF_NA} } },
	[NODE_SYSCALL_SEMGET] = {"semget", EC_PROCESS, EF_DROP_SIMPLE_CONS, 4, {{"key", PT_INT32, PF_HEX}, {"nsems", PT_INT32, PF_DEC}, {"semflg", PT_FLAGS32, PF_HEX, semget_flags},{"res", PT_ERRNO, PF_DEC}  } },
	[NODE_SYSCALL_ACCESS] = {"access", EC_FILE, EF_DROP_SIMPLE_CONS, 3, {{"mode", PT_FLAGS32, PF_HEX, access_flags},{"res", PT_ERRNO, PF_DEC}, {"name", PT_FSPATH, PF_NA} } },
	[NODE_SYSCALL_CHROOT] = {"chroot", EC_PROCESS, EF_MODIFIES_STATE, 2, {{"res", PT_ERRNO, PF_DEC}, {"path", PT_FSPATH, PF_NA} } },
	[NODE_SYSCALL_SETSID] = {"setsid", EC_PROCESS, EF_MODIFIES_STATE, 1, {{"res", PT_PID, PF_DEC} } },
	[NODE_SYSCALL_MKDIR_2] = {"mkdir", EC_FILE, EF_NONE, 3, {{"mode", PT_UINT32, PF_HEX},{"res", PT_ERRNO, PF_DEC}, {"path", PT_FSPATH, PF_NA} } },
	[NODE_SYSCALL_RMDIR_2] = {"rmdir", EC_FILE, EF_NONE, 2, {{"res", PT_ERRNO, PF_DEC}, {"path", PT_FSPATH, PF_NA} } },
	[NODE_SYSCALL_EXECVE_17] = {"execve", EC_PROCESS, EF_MODIFIES_STATE | EF_OLD_VERSION, 17, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_INT32, PF_DEC} } },
	[NODE_SYSCALL_UNSHARE] = {"unshare", EC_PROCESS, EF_NONE, 1, {{"flags", PT_FLAGS32, PF_HEX, clone_flags},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_EXECVE_18] = {"execve", EC_PROCESS, EF_MODIFIES_STATE | EF_OLD_VERSION, 18, {{"filename", PT_FSPATH, PF_NA},{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_INT32, PF_DEC} } },
	[NODE_SYSCALL_EXECVE_19] = {"execve", EC_PROCESS, EF_MODIFIES_STATE, 21, {{"filename", PT_FSPATH, PF_NA},{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_INT32, PF_DEC}, {"pgid", PT_PID, PF_DEC}, {"loginuid", PT_INT32, PF_DEC}, {"flags", PT_FLAGS32, PF_HEX, execve_flags} } },
	[NODE_SYSCALL_SETPGID] = {"setpgid", EC_PROCESS, EF_MODIFIES_STATE, 3, {{"pid", PT_PID, PF_DEC}, {"pgid", PT_PID, PF_DEC},{"res", PT_PID, PF_DEC} } },
	[NODE_SYSCALL_BPF] = {"bpf", EC_OTHER, EF_CREATES_FD, 2, {{"cmd", PT_INT64, PF_DEC},{"res_or_fd", PT_DYN, PF_DEC, bpf_dynamic_param, NOD_BPF_IDX_MAX} } },
	[NODE_SYSCALL_SECCOMP] = {"seccomp", EC_OTHER, EF_NONE, 2, {{"op", PT_UINT64, PF_DEC}, {"flags", PT_UINT64, PF_HEX},{"res", PT_ERRNO, PF_DEC} } },
	[NODE_SYSCALL_UNLINK_2] = {"unlink", EC_FILE, EF_NONE, 2, {{"res", PT_ERRNO, PF_DEC}, {"path", PT_FSPATH, PF_NA} } },
	[NODE_SYSCALL_UNLINKAT_2] = {"unlinkat", EC_FILE, EF_NONE, 4, {{"res", PT_ERRNO, PF_DEC}, {"dirfd", PT_FD, PF_DEC}, {"name", PT_FSRELPATH, PF_NA, DIRFD_PARAM(1)}, {"flags", PT_FLAGS32, PF_HEX, unlinkat_flags} } },
	[NODE_SYSCALL_MKDIRAT] = {"mkdirat", EC_FILE, EF_NONE, 4, {{"res", PT_ERRNO, PF_DEC}, {"dirfd", PT_FD, PF_DEC}, {"path", PT_FSRELPATH, PF_NA, DIRFD_PARAM(1)}, {"mode", PT_UINT32, PF_HEX} } },
	[NODE_SYSCALL_OPENAT_2] = {"openat", EC_FILE, EF_CREATES_FD | EF_MODIFIES_STATE, 6, {{"fd", PT_FD, PF_DEC}, {"dirfd", PT_FD, PF_DEC}, {"name", PT_FSRELPATH, PF_NA, DIRFD_PARAM(1)}, {"flags", PT_FLAGS32, PF_HEX, file_flags}, {"mode", PT_UINT32, PF_OCT}, {"dev", PT_UINT32, PF_HEX} } },
	[NODE_SYSCALL_LINK_2] = {"link", EC_FILE, EF_NONE, 3, {{"res", PT_ERRNO, PF_DEC}, {"oldpath", PT_FSPATH, PF_NA}, {"newpath", PT_FSPATH, PF_NA} } },
	[NODE_SYSCALL_LINKAT_2] = {"linkat", EC_FILE, EF_NONE, 6, {{"res", PT_ERRNO, PF_DEC}, {"olddir", PT_FD, PF_DEC}, {"oldpath", PT_FSRELPATH, PF_NA, DIRFD_PARAM(1)}, {"newdir", PT_FD, PF_DEC}, {"newpath", PT_FSRELPATH, PF_NA, DIRFD_PARAM(3)}, {"flags", PT_FLAGS32, PF_HEX, linkat_flags} } },
	[NODE_SYSCALL_FCHMODAT] = {"fchmodat", EC_FILE, EF_NONE, 4, {{"res", PT_ERRNO, PF_DEC}, {"dirfd", PT_FD, PF_DEC}, {"filename", PT_FSRELPATH, PF_NA, DIRFD_PARAM(1)}, {"mode", PT_MODE, PF_OCT, chmod_mode} } },
	[NODE_SYSCALL_CHMOD] = {"chmod", EC_FILE, EF_NONE, 3, {{"res", PT_ERRNO, PF_DEC}, {"filename", PT_FSPATH, PF_NA}, {"mode", PT_MODE, PF_OCT, chmod_mode} } },
	[NODE_SYSCALL_FCHMOD] = {"fchmod", EC_FILE, EF_NONE, 3, {{"res", PT_ERRNO, PF_DEC}, {"fd", PT_FD, PF_DEC}, {"mode", PT_MODE, PF_OCT, chmod_mode} } },
	[NODE_SYSCALL_RENAMEAT2] = {"renameat2", EC_FILE, EF_NONE, 6, {{"res", PT_ERRNO, PF_DEC}, {"olddirfd", PT_FD, PF_DEC}, {"oldpath", PT_FSRELPATH, PF_NA, DIRFD_PARAM(1)}, {"newdirfd", PT_FD, PF_DEC}, {"newpath", PT_FSRELPATH, PF_NA, DIRFD_PARAM(3)}, {"flags", PT_FLAGS32, PF_HEX, renameat2_flags} } },
	[NODE_SYSCALL_USERFAULTFD] = {"userfaultfd", EC_FILE, EF_CREATES_FD | EF_MODIFIES_STATE, 2, {{"res", PT_ERRNO, PF_DEC}, {"flags", PT_FLAGS32, PF_HEX, file_flags} } },
	[NODE_SYSCALL_OPENAT2] = {"openat2", EC_FILE, EF_CREATES_FD | EF_MODIFIES_STATE, 6, {{"fd", PT_FD, PF_DEC}, {"dirfd", PT_FD, PF_DEC}, {"name", PT_FSRELPATH, PF_NA, DIRFD_PARAM(1)}, {"flags", PT_FLAGS32, PF_HEX, file_flags}, {"mode", PT_UINT32, PF_OCT}, {"resolve", PT_FLAGS32, PF_HEX, openat2_flags} } },
	[NODE_SYSCALL_MPROTECT] = {"mprotect", EC_MEMORY, EF_DROP_SIMPLE_CONS, 4, {{"addr", PT_UINT64, PF_HEX}, {"length", PT_UINT64, PF_DEC}, {"prot", PT_FLAGS32, PF_HEX, prot_flags},{"res", PT_ERRNO, PF_DEC} } }, 
	[NODE_SYSCALL_EXECVEAT] = {"execveat", EC_PROCESS, EF_MODIFIES_STATE, 23, {{"dirfd", PT_FD, PF_DEC}, {"pathname", PT_FSRELPATH, PF_NA, DIRFD_PARAM(0)}, {"flags", PT_FLAGS32, PF_HEX, execveat_flags},{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_INT32, PF_DEC}, {"pgid", PT_PID, PF_DEC}, {"loginuid", PT_INT32, PF_DEC}, {"flags", PT_FLAGS32, PF_HEX, execve_flags} } },
	[NODE_SYSCALL_COPY_FILE_RANGE] = {"copy_file_range", EC_FILE, EF_USES_FD | EF_READS_FROM_FD | EF_WRITES_TO_FD, 6, {{"fdin", PT_FD, PF_DEC}, {"offin", PT_UINT64, PF_DEC}, {"len", PT_UINT64, PF_DEC},{"res", PT_ERRNO, PF_DEC}, {"fdout", PT_FD, PF_DEC}, {"offout", PT_UINT64, PF_DEC} } },
	[NODE_SYSCALL_CLONE3] = {"clone3", EC_PROCESS, EF_MODIFIES_STATE, 20, {{"res", PT_PID, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_INT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"flags", PT_FLAGS32, PF_HEX, clone_flags}, {"uid", PT_UINT32, PF_DEC}, {"gid", PT_UINT32, PF_DEC}, {"vtid", PT_PID, PF_DEC}, {"vpid", PT_PID, PF_DEC} } },
};
